syzbot

INFO: task kworker/1:5:5266 blocked for more than 143 seconds.
      Not tainted 6.12.0-rc3-syzkaller-00051-g07b887f8236e #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:5     state:D stack:25360 pid:5266  tgid:5266  ppid:2      flags:0x00004000
Workqueue: events_freezable usb_stor_scan_dwork
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5322 [inline]
 __schedule+0x105f/0x34b0 kernel/sched/core.c:6682
 __schedule_loop kernel/sched/core.c:6759 [inline]
 schedule+0xe7/0x350 kernel/sched/core.c:6774
 blk_mq_freeze_queue_wait+0x146/0x190 block/blk-mq.c:139
 blk_freeze_queue block/blk-mq.c:166 [inline]
 blk_mq_freeze_queue block/blk-mq.c:175 [inline]
 blk_mq_update_tag_set_shared+0xba/0x160 block/blk-mq.c:4035
 blk_mq_add_queue_tag_set block/blk-mq.c:4069 [inline]
 blk_mq_init_allocated_queue+0xd59/0x11f0 block/blk-mq.c:4343
 blk_mq_alloc_queue+0x1f8/0x2f0 block/blk-mq.c:4158
 scsi_alloc_sdev+0x897/0xd90 drivers/scsi/scsi_scan.c:337
 scsi_probe_and_add_lun+0x525/0x7b0 drivers/scsi/scsi_scan.c:1210
 scsi_sequential_lun_scan drivers/scsi/scsi_scan.c:1393 [inline]
 __scsi_scan_target+0x42c/0x4e0 drivers/scsi/scsi_scan.c:1764
 scsi_scan_channel drivers/scsi/scsi_scan.c:1845 [inline]
 scsi_scan_channel+0x149/0x1e0 drivers/scsi/scsi_scan.c:1821
 scsi_scan_host_selected+0x2ae/0x370 drivers/scsi/scsi_scan.c:1874
 do_scsi_scan_host+0x1ef/0x260 drivers/scsi/scsi_scan.c:2013
 scsi_scan_host drivers/scsi/scsi_scan.c:2043 [inline]
 scsi_scan_host+0x3a7/0x440 drivers/scsi/scsi_scan.c:2031
 usb_stor_scan_dwork+0xad/0x280 drivers/usb/storage/usb.c:998
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/30:
 #0: ffffffff88ebb100 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #0: ffffffff88ebb100 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff88ebb100 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x7f/0x390 kernel/locking/lockdep.c:6720
2 locks held by kworker/u8:5/220:
 #0: ffff888112499948 ((wq_completion)scsi_tmf_1){+.+.}-{0:0}, at: process_one_work+0x129b/0x1ba0 kernel/workqueue.c:3204
 #1: ffffc9000169fd80 ((work_completion)(&(&cmd->abort_work)->work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3205
5 locks held by kworker/0:2/802:
4 locks held by kworker/u8:7/1293:
 #0: ffff888100abf948 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x129b/0x1ba0 kernel/workqueue.c:3204
 #1: ffffc900028afd80 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3205
 #2: ffff8881023d6378 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline]
 #2: ffff8881023d6378 (&dev->mutex){....}-{3:3}, at: __device_attach_async_helper+0x84/0x290 drivers/base/dd.c:973
 #3: ffff888101bc98c0 (&q->limits_lock){+.+.}-{3:3}, at: queue_limits_start_update include/linux/blkdev.h:926 [inline]
 #3: ffff888101bc98c0 (&q->limits_lock){+.+.}-{3:3}, at: sd_revalidate_disk.isra.0+0x27a/0xa420 drivers/scsi/sd.c:3727
2 locks held by getty/2608:
 #0: ffff888113d710a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc900000432f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xfba/0x1480 drivers/tty/n_tty.c:2211
5 locks held by kworker/1:2/4922:
 #0: ffff888105adf548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x129b/0x1ba0 kernel/workqueue.c:3204
 #1: ffffc900048ffd80 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3205
 #2: ffff888109b98190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline]
 #2: ffff888109b98190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1be/0x4f40 drivers/usb/core/hub.c:5849
 #3: ffff8881f592d1f8
 (&tmc->lock){..-.}-{2:2}, at: console_trylock_spinning kernel/printk/printk.c:2042 [inline]
 (&tmc->lock){..-.}-{2:2}, at: vprintk_emit+0x638/0x6f0 kernel/printk/printk.c:2406
 #4: ffffffff88ea8870
 (console_srcu){....}-{0:0}, at: fs_reclaim_acquire mm/page_alloc.c:3851 [inline]
 (console_srcu){....}-{0:0}, at: fs_reclaim_acquire+0xae/0x150 mm/page_alloc.c:3842
5 locks held by kworker/0:5/5115:
4 locks held by kworker/1:5/5266:
 #0: ffff888100081548 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work+0x129b/0x1ba0 kernel/workqueue.c:3204
 #1: ffffc9000f64fd80 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3205
 #2: ffff8881158800e0 (&shost->scan_mutex){+.+.}-{3:3}, at: scsi_scan_host_selected+0x160/0x370 drivers/scsi/scsi_scan.c:1866
 #3: ffff8881158802d0 (&set->tag_list_lock){+.+.}-{3:3}, at: blk_mq_add_queue_tag_set block/blk-mq.c:4060 [inline]
 #3: ffff8881158802d0 (&set->tag_list_lock){+.+.}-{3:3}, at: blk_mq_init_allocated_queue+0x7bc/0x11f0 block/blk-mq.c:4343
4 locks held by udevd/5439:
 #0: ffff888112d8e1c8 (&p->lock){+.+.}-{3:3}, at: seq_read_iter+0xd8/0x12b0 fs/seq_file.c:182
 #1: ffff888116241c88 (&of->mutex){+.+.}-{3:3}, at: kernfs_seq_start+0x4d/0x240 fs/kernfs/file.c:154
 #2: ffff88810e70aa58 (kn->active#18){++++}-{0:0}, at: kernfs_seq_start+0x71/0x240 fs/kernfs/file.c:155
 #3: ffff88811a251190 (&dev->mutex){....}-{3:3}, at: device_lock_interruptible include/linux/device.h:1019 [inline]
 #3: ffff88811a251190 (&dev->mutex){....}-{3:3}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
1 lock held by usb-storage/5859:
 #0: ffff888115880d08 (&us_interface_key[i]){+.+.}-{3:3}, at: usb_stor_control_thread+0xd6/0xac0 drivers/usb/storage/usb.c:394
5 locks held by kworker/1:6/5878:
 #0: ffff888105adf548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x129b/0x1ba0 kernel/workqueue.c:3204
 #1: ffffc90010d9fd80 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3205
 #2: ffff88810635f190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline]
 #2: ffff88810635f190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1be/0x4f40 drivers/usb/core/hub.c:5849
 #3: ffff88813345b190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline]
 #3: ffff88813345b190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x10a/0x920 drivers/usb/core/hub.c:2295
 #4: ffff8881022dd160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline]
 #4: ffff8881022dd160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1095 [inline]
 #4: ffff8881022dd160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa4/0x610 drivers/base/dd.c:1293

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.12.0-rc3-syzkaller-00051-g07b887f8236e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline]
 watchdog+0xf0c/0x1240 kernel/hung_task.c:379
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 7112 Comm: syz.2.618 Not tainted 6.12.0-rc3-syzkaller-00051-g07b887f8236e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:check_kcov_mode kernel/kcov.c:183 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x1c/0x70 kernel/kcov.c:217
Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 48 8b 15 d4 e4 ad 7e 65 8b 05 d5 e4 ad 7e a9 00 01 ff 00 48 8b 34 24 <74> 1d f6 c4 01 74 43 a9 00 00 0f 00 75 3c a9 00 00 f0 00 75 35 8b
RSP: 0018:ffffc9001151f690 EFLAGS: 00000246
RAX: 0000000080000001 RBX: ffffc9001151fad0 RCX: ffffffff819af9ca
RDX: ffff88811f928000 RSI: ffffffff819af9e2 RDI: 0000000000000007
RBP: fff0000000000fff R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: 800000012cdc6007 R14: 00007fc44468c000 R15: 00007fc444800000
FS:  0000000000000000(0000) GS:ffff8881f5900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3181fffc CR3: 0000000115742000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 pte_flags arch/x86/include/asm/pgtable_types.h:481 [inline]
 pte_present arch/x86/include/asm/pgtable.h:1012 [inline]
 zap_pte_range mm/memory.c:1619 [inline]
 zap_pmd_range mm/memory.c:1739 [inline]
 zap_pud_range mm/memory.c:1768 [inline]
 zap_p4d_range mm/memory.c:1789 [inline]
 unmap_page_range+0x642/0x2fa0 mm/memory.c:1810
 unmap_single_vma+0x194/0x2b0 mm/memory.c:1856
 unmap_vmas+0x22f/0x490 mm/memory.c:1900
 exit_mmap+0x1c6/0xb30 mm/mmap.c:1864
 __mmput kernel/fork.c:1347 [inline]
 mmput+0xdb/0x3e0 kernel/fork.c:1369
 exit_mm kernel/exit.c:571 [inline]
 do_exit+0x9bf/0x2ce0 kernel/exit.c:926
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1088
 get_signal+0x25fb/0x2770 kernel/signal.c:2917
 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x147/0x260 kernel/entry/common.c:218
 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc44585dff9
Code: Unable to access opcode bytes at 0x7fc44585dfcf.
RSP: 002b:00007fc4444d70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fc445a15f88 RCX: 00007fc44585dff9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc445a15f88
RBP: 00007fc445a15f80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc445a15f8c
R13: 0000000000000000 R14: 00007ffc31192220 R15: 00007ffc31192308
 </TASK>